When hacking using a console and cheat cart, is it always possible to find pointers?

[hatrickpatrick]

Very random question: I got out CBFD with some mates last night for the craic, we were playing the Colours multiplayer.

Afterwards I was trying to see if I could make some weapons disappear from the game to make it more interesting (with anything above a "normal" AI, the shotgun makes the game incredibly boring as the AI takes every human player out before they get anywhere near the base).

When you pick up a weapon, it takes a few seconds for the weapon to reappear in the same place. I figured this was going to be easily hackable, sure enough found a boolean byte which, when set to 1, makes the weapon vanish.

Here's the catch: this variable's location moves around in RAM every time a new game is started. so far this has made it impossible to create a permanent code to disable the weapon. My usual procedure when this happens is to search, using the code generator, for 16-bit values containing the first four digits of the address in RAM, and use this to eventually find the pointer and fix it.

On this occasion, I've been unable to find any pointers which point anywhere near the section of RAM these variables move around in. So my question is, is there another mechanism by which variables move, apart from pointers in RAM? And if so, is it just impossible to fix them?

Also, the equalizer lists all RAM addresses as beginning with "80", will pointers also begin with 80 or is that purely a control code for the cheat cart (80 = 8 bit code, 81 = 16 bit) - would pointers in memory be 4-byte addresses beginning with 80, or 3-byte addresses without the 80, or indeed 4-byte addresses beginning with 00?

Know these are ancient and probably boring questions, but it's been years since I've messed around with this kind of thing and I'm incredibly rusty.

EDIT: If anyone's interested, these are two of the addresses the variable appeared at during different games:
801B0C4E
801B0C6E

So I searched in memory for pointers by looking for 16-bit values of "8018", found a few but nothing pointing anywhere near the "0CXX" area.